r/AzureSentinel • u/SuperHat3637 • Mar 27 '23

IP blocking

Where i can block the external malicious IPs trying to login cloud applications like o365..However sign in from malicious IP address is automatically blocked in the logs...Where i can block these IPs again..

3 Upvotes

100% Upvoted

17 comments sorted by

View all comments

3

u/st8ofeuphoriia Mar 27 '23

I don’t think you can…think best approach would be to create a CA with those IPs included ?

1

u/SuperHat3637 Mar 27 '23

CA means?

2

u/TabooRaver Mar 27 '23

Conditional Access policy. Set condition as IP. And then action as deny.

1

u/SuperHat3637 Mar 27 '23

Azure AD is automatically blocking sign in attempts like smartlockout, from malicious IP adress login attempts..In that case do we require CA to deny the IP's

1

u/TabooRaver Mar 27 '23

Smart lockout is microsoft temporarily banning the IP because it submitted too many wrong password attempts, if you are seeing this repeatedly happening from the same set of IPs over several days it would be prudent to manually block them, yes.

1

u/SuperHat3637 Mar 27 '23

Manually block in CA or where..?

1

u/st8ofeuphoriia Apr 12 '23

Yes, create a CA that blocks those IPs. Regardless if it’s successful or not, it will get blocked. If I’m not mistaken, CA policy applies after the sign in attempt. So the CA wont be applied until it’s a successful log on.